On Mon, Feb 03, 2003 at 06:09:27PM +0530, Shabbir Husain wrote:
> However when i validate the results of my collector and a standard network
> management tool(using SNMP) , their is a difference of
> 3-300 % and more . I am clueless as to why there is so much difference .
With SNMP you most likely read interface statistics. Those statistics
include the Ethernet frame for each IP packet where netflow only counts
beginning with the IP header. Also the interface statistics count all
the various broadcasts (OSPF, Windows, spanning tree(?)) that gets not
forwarded and accounted on the router that does netflow.

Also keep in mind that you have to do netflow on all *incoming
interfaces*. If (answer) packets came from outside your net to the host
behind the router you have to enable it on the interface pointing to
your host and the interface pointing to your upstream provider(s).